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(54) Telecommunications system 

(57) In a telecommunications system such as a glo- 
bal mobile telephone network In which each subscrber 
unit Includes a Subscriber Identity Module (SIM card), 
each SIM card has fixed memory locations (22), to 
which data can be addressed over the air. The locations 
(22) can be accessed from the subsaiber unit on the 
entry of short simple codes, each associated with one of 
the locations. Further fixed memory locations (24) can 
be read over the air only when the subscriber enters a 
persona] identification number. Also, the SIM contains 
means which are operable to act on receipt of a signal, 
from the user of the subscriber unit or from a host sta- 
tion, to determine and undertake an appropriate 
response to the signal. 
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Description 

This invention relates to a telecommunications sys- 
tem. In partioular, but not exclusively, it relates to a 
mobile communications system such as a cellular 
nnobile radio or telephone system. 

A r^ent innovation in such systems has been the 
introduction of Subscrber Identity Modules (SIM cards). 
These are integrated circuit cards which can be releas- 
ably insertoj into a mobile telephone and which contain 
in memory the subsaibeTs 'dentity. i.e. his telephone 
number. These known SIM cards also have a memory 
area which can store a certain number of alphanumeric 
characters. The memory area facilitates the so-called 
Short Message Service (SMS) in which a message for a 
subscriber or for a specified group of subscribers can be 
broadcast over the air, as an advanced form of radiop- 
Paging. Messages can be received by a mobile tele- 
phone whenever it is icfie or during a caH. However, if a 
message is received which would overfill tiie memory 
area, data is held at the host station until such time as 
the subscriber manually clears a space for it. 

US-A-5 127 040 describes a method and apparatus 
for, remotely loading repertory telephone numbers into a 
mobile unit The numbers can be recalled and used 
later by the sut)SGriber. 

EP-AO 459 344 desaibes a method of download- 
ing and executing software in a remote terminal of a 
communications system. 

WOA-91/126^ discloses a mobile radio tele- 
phone toving a SIM card which has been programmed 
only to authorise the ise of certain services. Such pro- 
gramming takes place directly and not remotdy. 

It is an object of the invention to provide a more effi- 
cient and remotely reconfigurable SIM card. 

According to a first aspect of the present invention 
there is provided a telecommunications system as 
claimed in claim 1. 

Making use of the invention, it is possible for a set 
of telqdhone numbers, each with an kientifying alphanu- 
meric tag. to be transmitt^ to tiie SIM card, allowing 
users easy access to commcnly used services such as 
hotels, car hire or airline resenrations. This feature is 
known as a Value Added Service Directory. 

A message may be retrievable by the stA)scriber on 
the entry of simple, short codes into the sut^scribe^ unit 
each memory location corresponding to a particular 
code. A message may include a telephone number and, 
once stored, may be able to be ovenAoitten over the air. 
Preferably, the or each host station is operable to trans- 
mit a r&:)uest tor information stored in a sut)scriber unit 
The information may be included in a message and it 
may also include infbrrretion which is stored in a secure 
memory location, accessttsle only when the subscriber 
enters a personal kientification number (PIN number). 
The infbrnation may include credit details relevant to 
the subsatber, for example, a aedtt card nun^er of 
cr&lit status, thus greatiy facilitating credit card transac- 



tions carried out over the telephone. Using this feature 
of the inventk)n. a credit account holder avokls having to 
dictate his account details and need only enter the man- 
datory PIN number. 

s The host station may be operable to transmit 
instructions to lock and/or unk}ck a memory location at 
tiie subscriber unit. It n^y be operable to transmit 
instructions to run a program stored in memory loca- 
tions at the sut)scriber unit. The host station may be 

10 operak)le to transmit files containing functional data 
and/or files containing non-functtonal data to the sut>- 
scriber unit. 

The messages, requests for information and ttie 
instructions are transmitted in a pacific format whk:h 
75 tiie subscriber unit is able to distinguish from other for- 
mats. The specific fbrniat may be rhade secure against 
interception. 

In a preferr^ embodiment the subscriber unit 
comprises a moUle radio or telephone and an inte- 

20 grated circuit card whk:h can be removably connected 
to the radiotelephone. The integrated circuit card may 
contain the memory locations ar%l may contain means 
for distinguishing the ^ecif k: format from other fbrn^ts. 
The card may contain means fbr distinguishing t>etween 

2s tiie messages, requests for infbnration and instruc- 
tions. The card may also contain the means tor storing 
the messages and means fbr acting on the requests 
and instructions. 

From another a^ect. the invention consists in a 

30 module as claimed in claim 20. 

The module may include a directory structure within 
which f Oes can be stored. 

The invention is partioiarly applicat^le to global tel- 
eootnmurucation systems in which the mobile cellular 

35 telephone networks of various countries or areas com- 
municate usng a common standard. An example of 
such a ^obal system is QSM (Global System fbr Mobile 
Communications) currentiy operating in Europe How- 
ever the inventbn is not limited to global systen^ and 

40 could be applied to a single national cellular networic or 
e/et\ to a fixed land-link^ network 

An embodiment of the invention will now be 
described by way of example witii reference to the 
accompanying drawings in which:- 

45 

Rgure 1 shows the transmission of messages to a 
subsaber unit in a system according to tiie inven- 
tion; 

Rgure 2 shov^ a process in which a subscriber unit 
50 transmits a message and requested infbrmation; 

Rgure 3 is a block diagram showing elements of a 
module shown in figures 1 and 2; 
Rgure 4 shows details of one of ttie bkxks ^own in 
figure 3; and 

55 Rgure 5 is a flowchart showing tiie operation of the 
module shown in figures 1 to 4. 

Rgure 1 illustrates an SMS dstribution path 
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according to the iriN/ention. tn the prior art, the short 

messages have usually been directed to a single sub- 
scrfoer or a ^edfied group of subscnt)ers such as a 
sales term. 

However. GSM also supports a feature known as 
Cell Broadcast in which messages can be sent to all the 
sut>scriber8 in a particular area In the emt>odiment of 
the invention illustrated, a message consists of the tele- 
phone nunt)er of an advertiser ad an alphanumeric tag 
to identify the advertiser. 

An operator enters the massage into a terminal 1. 
The message is then coded into a secure fbmnat knob 
as an Embedded Command Stream (ECS) ad sent via 
a mode 2 and a fixed Line 3 to a local GSM ^tch 4. 
According to its delivery address, the message is deliv- 
ered to any or all of the other switches within that net- 
worK or even across networks. 

The switch 4. which in this example in in the geo- 
graphical area to which the message is to be transmit- 
ted, delivers the mes^ge to a number of cellsites 5. 
The cellsites 5 are the base transceiver stations of the 
GSM network 

Each cellate 5 then broadcasts the message to a 
, group of transceivers or mobile telephones, herenafter 
referred to as "mottles". If Cell Broadcast is used, the 
group consists of all mobiles within the geograpNcal 
area at the time of the broadcast. 

A selected mobile 6 receiving the message trans- 
mits a confirmation of receipt back to its respective cell- 
site 5. From now on, untD an update situation, the 
system will not contact this mobile 6 a^n. 

The mobile 6 recognises the message as SMS data 
and passes it to a SIM card 7, which Is a small self-con- 
tained microprocessor, held in a slot in the mot»le 6. 
. The SIM card 7 in turn recognises the ECS using 
cial hardware and software and stores the message in 
memory in such a way that it may not be overwritten t>y 
the subscrber. Known SIM cards contain a large 
nun*er of fixed memory locations in which the aib- 
scriber can store frequently dialled numbers and corre- 
sponding alphanumeric tags. The SIM card 7 of the 
invention stores the message in one of these tocatkms. 
and then can'ies out a write protect operation. The loca- 
tions dedicated to storing write protected messages 
may be designated by code numbers relating to a par- 
ticular category of advertiser. Thus, for example, car 
hire company telephone numbers can be stor&j in loca- 
tion 01, hotel reservations in location 02 and so on. 

Rgure 2 shows a call placing process in which a 
subscriber communicates with an advertiser. The sub- 
scriber, remembering that the car hire company^ 
number is in location 01 as shown at 8. keys in a stort 
code con-esponding to the location, such as 01#. The 
mobile 6 then interrogates tiie SIM card 7 to retrieve the 
telephone number from tiie kx»tion. The SIM card 7 
provides botfi the number and the alphanumeric tag giv- 
ing the company's name and displays it to the sub- 
scriber. The user confirms that he wishes to proceed k>y 



pressing SEND. 

Next, tiie mobile obtains a voice channel through 
v-ttich the call proceeds to tiie dialled number. The GSM 
system automatically handles intra-network and inter- 

5 n6twori< hqsa At this point the subscrQjer can hokJ a 
voice oonver^tion with the company. 

Providing the correct equipment has been installed 
at the cc^any, as soon as tiie call is answered, sub- 
scriber identity infbmnation read from the SIM card 7 

10 gives the company immediate customer k»lling details 
such as a name and address. 

The SIM card 7 also contains information detailing 
tiie subscrber's aedit account. This infbrnr^tion is held 
in a s^arate. s^re memory location, accessible only 

15 when the subscriber enters a mandatory PIN number, 
known only to himself, thus confirming that tiie mobile 
has not been stolen or tost When the subscriber \ms 
confirmed his car hire deal, he enters the PIN number 
into tiie mobile 6. requesting the aecGt information from 

20 tiie SIM card 7. The SIM card 7 supplies tiie information 
and the mobile uses existing voice/data technk^ues to 
transnr^ tiie infomnatbn to the company, in a format 
secure against detection by fraudsters. The sale is con- 
firmed by the company or its equipment and tiie call is 

2S terminated. 

tn tills example, it is also possible to dDtain a tele- 
phone or fax number from tiie operator-assisted direc- 
tory enquiries system without tiie 6ubsait>er having to 
manually enter tiie number into tiie oommunk»tions ter- 

30 minal which he desires to usa 

To use this feature, the subscriber calls network 
directory enquiries and gives the name of the person, 
company or service of which he wishes to ascertain the 
tel^one number, as well as any additional Information 

35 requested by the operator answering the call. The oper- 
ator then locates the number, confirms it and enquires 
as to whetiier the number is to be transmitted verbally, 
transferred over SMS into a given memory k)cafion of 
the subsaiber's SIM card or botii. 

40 If tiie subscriber chooses a SIM update, the voice 
call is terminated and the operator initiates the SiVIS 
process by entering a sequence into a computer or 
pressing a dedicated button. The tel^hone number is 
tiien encoded into an ECS message at the despatch 

46 centre and is posted across tiie network to the sub- 
scriber's communications terminal. whk;h transmits a 
confirmation to the des(»tch centra Thus tiie retry 
mechanism, which operates until such a confirmation is 
received, is suspended. 

so The communications terminal recognises the mes- 
sage as SMS data, passes it to tiie SIM card, and if 
capable, cD^ays a •'message received" banner. The 
SIM card in turn recognises tiie ECS uang special terd- 
ware and software, and decodes it accordingly The 

55 nunnber. and any associated a^hanumeric tag, which 
would normally consist of tiie name of tiie person or 
company, are r^xsvered together witti the memory loca- 
tion in which ttiey are intendej to be stored. The 
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number and name-tag are then written to that location 
and are write-protected if requested by the subscrber, 
the oveiwrite p-otectiori being encoded Into the mes- 
sage at source. 

Subsequently, the subscriber attempts to place a 
call to the number in the known memory location by key- 
ing in the memory location number. The SIM card 
passes the tel^hone or fax number to the communica- 
tions terminal on demand, and upon receipt of the sub- 
saiber's confirmation, the comnuinications terrrunal 
sets up the call to the desired number. 

Figure 3 shows the electronic structure of the SIM 
card 7. The card communicates with the mobile to which 
it is connected via an irput/output (I/O) manager 15, 
preferably using the protocol ISO 7816 T=0. A filter 16 
receives incoming data from the I/O manager and 
detects any ECS messages from among the short mes- 
' sages received. The ECS messages are sent directly to 
an extended erasable read only memory (E^ROiVl) 17. 
whteh is preferably a *Ybsh" E^ROM. Data can also be 
output from the E^ROM directly to the I/O manager 15. 
The remaining bkKks shown in figure 3 are standard 
compon^ of a Sii^ card. 

Rgure 4 shows how the E^ROiVl is organised. A 
root directory 18 contains a SIM administration and 
identifier 19, a GSM directory and network data 20, and 
a telecom directory 21 . 

The telecom directory in turn contains memory 
locations as fdlov^: "abbreviated dial numbers" 22, 
'capability configuration*' 23, "short messages" 24. 
"fixed dial numbers'* 25, and "charging counter 26. 
Each block represents a plurality of memory locations. 
The fr^uentty dialled numbers and corresponding 
alphanumeric tags are stored at locations 22. 

. The "abbreviated dial numbers* k)cations 22 and 
the "short mes^ges" locations 24 each have an asso- 
ciated locking control file 27. 28 respectively. TTie lock- 
ing control files constitute means for read^ite 
prot&:ting and removing read/write protection from their 
assodatoi memory locations. The locking control files 
27. 28 win typically be in the telecom directory 21 as 
shown, however they can be located elsewhere such as 
in an administration directory. 

Figure 5 is a flowchart illustrating the operation of 
the SIM card 7, which uses the specially fabricated 
hardware and software which has been descrtoed 
above to implemeit the operations illustrated. At loz- 
enge 9, messages, requests, and instructions having 
ECS are distinguished from those without. Each of 
these ECS types consists of a data stream headed by a 
comnand which is one of at least four types: write conrv 
mands for the messages, read commands for the 
requests for information, attribute commands for lock or 
unlock instructions and run comrrands for instructtons 
to run a program. 

The commartd and data types are decoded at box 
10 arrd actaJ on in one of the four paths 11-14. 

Path 1 1 handles the write commands to store mes- 



sages starting at a location specified therein. Path 12 
handles the read commands: again, the requests for 
information contain a location to be accessed first Suc- 
cessive locations are read and the data ^ed in a 
5 buffer until the required amount of data has been read. 
The data in the buffer is then encode into the ECS for- 
mat and de^tched from the mobile using SMS to the 
calling party. 

In path 13. attribute commands are used to lock or 

10 unlock sp^ifi^ memory locations ad render them 
accessible or inaccessble. either to calling parties or to 
the siibscrik^er. In path 14, run commands cause a pro- 
gram stored in the SIM card to be run. 

Ihe basic ECS system is expandable to up to 255 

15 internal shell commands of whch write, read, 
lock/unlock and run are four examples. The specific pro- 
tocol used for the transfer of information is not fixed and 
could be IS07816 T=0 or any other suitable protocol. 
The internal shell commands are a supplemerrt to 

20 the ability of the system to aeate external file objects 
within the SIM card 7. The file objects are of two types: 
Application Data Re Programs (ADFP's) containing 
functional data which can be executed by the SIM card 
pnxessor and can self modify if required and Applica- 

25 tkxi Data Res (ADPs) containing non-functk)nal data 
which do^ not have th^ capabilities. Existing 
ADF(P)*8 can be modified over-the<air enabling 
advancoJ facilities such as personalisaticn, re-person- 
alisation or downloadable phone book. 

30 The SIM card 7 has a directory structure, similar to 
that of a computer disk, and new ADF(P)*s can be 
dovimloaded into any directory over the air. Also over the 
air, drectories can be create, deleted and modified, 
multiple tree directory operations can be carried out and 

35 ADF(P)'8 that are no longer required can be deleted. 
The amount of ADF(P) data which can be downloaded 
is limited only by the size of the E^ROM memory of the 
card. 

The invention, as described, greatly extends the. 

40 applications of SIM cards. For eocample. using the Value 
Added Services Directory, subscribers can book hotels 
and airline seats over their mobiles quicMy ad easly. 

An additional advantage of this feature of invention 
is that the geographical distribution of messages to 

46 cards in a specific area such as the South of Franco is 
facilitated. Thus advertisers can direct their messages 
to all mobile subscribers in the specific area. This is, 
particularty useful when subscribers 'roam' from one 
area to another and have no knowledge of local serv- 

so ices. 

The directory enquiries download enables contact 
telephone or fax numbers to be delivered to a sub- 
scrit^er's communications termina] wittraut any int^en- 
tion by the sutscn^ber. The process of nanually entering 
ss a number whilst engagoi in a call to the operator is 
often dangerous, especially when the aibscriber is driv- 
ing. 

The abiTity of the system to download ADF(P)*8 
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means that additional services can be added to the SIM 
card ever the air while maintaining total compat'b'Oty 
with the existing celiuiar system. Thus the S(M card 
could acquire the functions of a aedit card, passport, 
driving licence, car park pass, membership card and so 5 
on. becoming a multiservice card Also, dynamically 
updatabte services can be added which require a differ- 
ent process to be run each time a service is accessed. 

Once the card has extra sen/ice on it. it can be used 
outside of the mobile phone environment if desired as a 10 
standalone item. This can be read from or written to l>y 
a dedicated piece of hardware, such as a point of sale 
machine. If desired, the new services can be deleted, 
however the card will nes^er lose its mobile phone SIM 
capability. In addition, if the card has extra senrices. is 
they will continue to function even if the subscriber has 
been disconnected from the mobile phone network, 
unless othenMse desired. 

Modifications are possbte without departing from 
thesoopeof the invention. 20 

For example, the SIM card can be trained only to 
receive messages detailing services relevant to the sub- 
scriber's needs. 

Claims 2S 

1. A telecommunicatksns system comprising at least 
one host station (1) and a plurality of subscriber 
units (6) , each of whk:h has a multiplicity of memory 
k)cations, the or each host statk)n being operable to 30 
transmit a message to at least one of the subscriber 
units, characterised in that 

said message Is coded in a specific format 
distinguished from other formats used in the system 
and conprises a data stream indudng a command 35 
which is one of at least a write command for writing 
data to a selected memory locatioa a read com- 
mand for requesting data stored in the subscriber 
unit, an attribute command to enable or prohitnt a 
selected memory location to be overwritten or to be 40 
read from the or each host station or the subscriber 
urvt. and a run command for executing functional 
data stored at a selected memory locatkm; and in 
that 

each subsaiber unit has means for detect- 4S 
ing a message coded in said specific format (16), 
means for decoding said message, and means 
responsive to sakf commands to detennine and 
undertake appropriate processing of the associated 
data so 

2. A system according to daim 1, wherein each sUb- 
saber unit (6) includes access means enat>ling 
said memory locations (17) to be selectively 
accessed, when required, to fetch from a selected ss 
memory location the data stored therein. 

3. A system according to daim 2. wherein each skjb- 



scrber unit (6) includes means to present informa- 
tion oon-esponding to the fetched data to a user of 
the subscnl)er unit 

4. A system according to daim 2 or 3. wherein each 
sii)scriber unit (6) indudes means to transmit the 
fetched data to said at least one host station (1). 

5. A system according to daim 3 or 4. wherein each 
subscriber unit (6) includes means adapted to 
transmit said data as a second message coded in. 
said specific format 

6. A system according to daim 5. wherein the data is 
fetched from successive memory locations (17). is 
k)uffered. coded in said specific format arvi. thereaf- 
ter, transmitted. 

7. A system according to daim 2. 3. 4, 5 or 6. wherein 
the memory locations (17) indude memory loca- 
tions identified by short codes, and induding means 
responsive to the entry of a selected short code by 
the access means to fetch the data from the corre- 
sponding memory locatioa 

8. A system according to daim 7. wherdn said short 
codes are abbreviated dial number codes. 

9. A system according to any preceding daim 2 to 8. 
wherein each subscriber unit (6) includes a send 
means for instigating dialling of a telephone number 
contained in the fetched data and. in response to a 
dialled call to said telephone number t>elng 
answered, data is fetched from a predetermined 
memory location of sa'd nrultiplidty of memory 
focations (17) and sent to receiving equipment 
associated witii said telephone number. 

10. A system according to daim 2 to 9. wherein the 
memory locations (17) indude secure memory 
locations and the access means is only ab\e to fetch 
data from a Secure location in response to the entry 
of a personal klentification signal into the sub- 
scriber unit (6). 

11. A system according to any preceding claim, 
wherein said messages are coded in a secure for- 
mat 

12. A system as claimed in daim 11, wherein the 
secure famat is in the fbrm of an embedded com- 
mand stream. 

13. A system according to any preceding claim, 
wherein said messages are transnrvtted using a 
short message service. 

14. A system according to any preceding claim. 
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wherein the messages carry executable application 
data file progranns for providing each subscriber 
unit (6) with additional services. 

15. A system according to any preceding dalm. 
wherein the memory locations (17) have file han- 
dling capabOities including directory functionsw 

16. A system according to daim 15, wherein data 
related to said attribute commands is stored in lock- 
ing control files (27.28) within predetermined direc- 
tales. 

17. A system according to any preceding daim which is 
a cellular radio communication system. 

18. A system accoiding to daim 17. induding means 
for transmitting the messages simultaneously to 
more than one subscriber unit (6) via cell broad- 
casting. 

19. A system according to any preceding daim. 
wherein the memory locations (17), detecting and 

. decoding means and means responsive to the 
commands are comprised in an integrated drcuit 
module or card (7) removably connected to each 
subscriber unit (6). 

20. A module (7) for contrdling a Gubsaber unit (6) in 
a telecommunications system including at least one 
host station (1) operable to transmit a message to 
the module, said module being adapted to be 
removably connected to the subscriber unit and 
comprising a multiplicity of memory locations (17). 

. characterised in that 

said module conprises means for detecting 
messages transmitted thereto, and coded in a spe- 
cific format distinguished from other famats used in 
the system, each said message conprising a data 
stream induding a command which is one of a! 
least a write command for writing data to a selected 
memory location, a read command for requesting 
data stored at a selected memory location, an 
attrOxrte oomniand to enable or prohtott a selected 
memory location to be overwritten or to t>e read 
from the or each host station or the subscriber unit, 
and a run command for executing functional data 
stored at a selected memory location; and in that 

said module further comprises means for 
decoding said messages and means responsive to 
said commands to determine and undertake appro- 
priate processing of the data contained in the mes- 
sage 

21. A module (7) according to daim 20. including read 
means operable to fetch data stored In the memory 
locations and transmit the data stored in a selected 
memory location to the associated subscriber unit 
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22. A module (7) according to claim 21. wherein the 
read means is adapted to transmit said data as a 
second message coded in said specific format 

s 23. A nvxjlule (7) according to daim 21 or 22, wherein 
the read means is responsive to a personal identifi- 
cation signal entered into the assodated subscriber 
unit (6). 

10 24. A module (7) according to claim 21, 22 or 23. 
wherein the menxsry locations (1 7) are identified by 
short codes and the module indudes means 
responsive to short codes to transmit data from the 
selected menrxiry location. 

IS 

25. A nxxluie (7) according to any preceding claim 20 
to 24. including a directory structure for addressing 
the memory locations. 

20 26. A module (7) according to any preceding claim 20 
to 25. which is programmable for use away from the 
subscriber unit by downfoacfing extra servkses onto 
it via said at least one host station, prior to remov- 
ing it from the subscriber unit 

2S 

zr. A nxxiule (7) according to any precedir^f daim 20 
to 26. wherein the module is in tiie fonn of an inte- 
grated drcuit cvd. 

30 
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